Incidents are divided to  and  lists.

When the incident is closed or resolved, it is transferred to  list after the timeout, defined in the  section of the  file like this:

...
  "server" : {
    ...
    "incident_timeout": 3600000,
    ...
  },
...